WORKPLACE PRIVACY: MANAGING EMPLOYEES IN CYBERSPACE

Transcription

1 WORKPLACE PRIVACY: MANAGING EMPLOYEES IN CYBERSPACE Karen M. Sargeant Partner Fasken Martineau DuMoulin Kim Potter Student Fasken Martineau DuMoulin Canadian Bar Association National Administrative Law, Labour & Employment Law and Privacy & Access Law Conference November 26, 2010

2 - 2 - WORKPLACE PRIVACY: MANAGING EMPLOYEES IN CYBERSPACE By Karen M. Sargeant and Kim Potter OVERVIEW OF PRIVACY LEGISLATION IN CANADA Federal and provincial privacy legislation places limits on the ability of employers to collect, use and disclose personal employee information obtained online or elsewhere. Canada has many different types of legislation that govern both federal and provincial employees, in both the public and private sectors. Privacy Legislation in the Public Sector The federal government and all of the provinces have privacy legislation that protects personal information collected by government institutions. These pieces of legislation provide individuals with a right to access and correct their personal information, as well as place limits on the ability of government institutions to collect, use and disclose employee personal information. Generally, a government institution must collect personal information directly from the individual about whom it relates. The individual must be informed about the purpose for which the information is sought, except in certain circumstances prescribed by statute. Personal information can only be used for the purpose for which it was originally obtained, and generally it may only be disclosed with the consent of the individual concerned. Oversight is maintained through either an independent commissioner or an ombudsperson who is authorized to receive and investigate complaints. These pieces of legislation apply to public sector federal employers and public sector employers in the various provinces.

3 - 3 - Federal Privacy Legislation in the Private Sector The Personal Information Protection and Electronic Documents Act ( PIPEDA ) governs information collected, used or disclosed by private organizations that engage in commercial activities. Like the public sector legislation, PIPEDA gives individuals the right to access and request correction of their personal information. Consent is required for the collection of personal information and the subsequent use or disclosure of this information. Under PIPEDA, organizations must implement procedures to protect personal information, receive and respond to complaints and inquiries, train and communicate to staff information about the organization s policies and procedures, and develop information that explains the organization s polices and procedures. Oversight is maintained by the federal Privacy Commissioner. PIPEDA applies to employers engaged in federal works, undertakings and businesses. Provincial Privacy Legislation in the Private Sector Alberta, British Columbia and Quebec have enacted legislation that is similar to PIPEDA. Alberta and British Columbia Alberta and British Columbia are the only two provinces that have private-sector privacy legislation that distinguishes between employment and non-employment personal information. Under the Alberta and British Columbia Personal Information Protection Acts, personal employee information is defined as information that is reasonably required for an employer to establish, manage or terminate an employment relationship between an organization and an individual (Alberta s definition also includes information that is reasonably required to manage a post-employment relationship). Personal employee information is a subset of personal

4 - 4 - information as it only includes information that arises in the context of an employment relationship; i.e. it does not include information such as personal family issues, non-work-related health issues, religious or financial issues. Under the Alberta and British Columbia Acts, an organization may collect, use and/or disclose personal employee information if the collection, use, and/or disclosure of the information is reasonable. What is reasonable is subjective, but employers should consider whether the information is necessary to ensure that the individual has the necessary skill set, training, or background for the position. The Alberta and British Columbia Acts also impose notice requirements, rather than consent requirements, for the collection, use and/or disclosure of personal employee information (under the Alberta Act, notice is only required for current employees). Under the notice provision, an organization is obligated to disclose to the individual the purposes for which the information is going to be used, collected and/or disclosed. Employee protections regarding safeguards, access and opportunity for correction requirements apply to personal employee information to the same extent as they do to all other personal information. The Alberta and British Columbia Acts differ from PIPEDA with respect to personal employment information, as PIPEDA does not create a different set of obligations for organizations to follow for personal employee information.

5 - 5 - Quebec The Quebec private sector privacy legislation is called An Act respecting the protection of personal information in the private sector. It is similar in principle to PIPEDA; however, it applies to all private sector organizations (not just those engaged in commercial activities) with respect to the collection, use and disclosure of personal information. It also applies to personal employee information and health information. Other Provinces The provinces other than British Columbia, Alberta and Quebec have no private sector privacy legislation governing the collection, use and disclosure of employee personal information in the employment context. As such, it can be easier to manage employees computer and internet use in such provinces. Provincial Privacy Legislation: Health Records Alberta, Manitoba, Ontario, Quebec and Saskatchewan have also enacted separate legislation to deal exclusively with the collection, use and disclosure of personal health information in the private sector. 1 This legislation is important for employers to keep in mind if they have employees or consultants who become custodians of employee health information. Examples include company physicians and occupational health departments. There may be restrictions on how these individuals use and disclose employees personal health information. 1 Health Information Act, R.S.A c. H.5; Personal Health Information Act, S.M c. 51, C.C.S.M., c. P33.5; Personal Health Information Protection Act, 2004 S.O. 2004, c. 3 Sched. A; An Act Respecting Health Services and Social Services, L.R.Q., c. S-4.2; Health Information Protection Act, S.S c. H

6 - 6 - EMPLOYEES AND SOCIAL MEDIA Why do we Care about Employees Use of Social Media? Employees use of social media both in and out of the workplace poses many potential problems for employers. Loss of Productivity At work, employees use of social media can result in a loss of productivity for their employers. Canadian employees waste approximately 800 million hours of work time per year surfing the Internet. On average, Canadian employees send 2.6 personal s from work every day. Seven percent of employees admit to sending ten or more personal s from work daily. The increasing popularity of social networking websites such as Facebook, LinkedIn, and Twitter, exacerbate this loss of productivity, as employees spend on average 29.6 minutes per day on social networking sites. Risk to Confidential Information Employees use of social media may also have negative consequences for their employers even when used outside of the workplace. For example, confidential information about the company may be disclosed either purposefully or inadvertently if employees forward s to external addresses or disclose confidential information on a blog or social networking site. Employees may also make defamatory or inappropriate statements online about the company they work for and/or their colleagues.

7 - 7 - Disseminating Improper Information In the worst cases, employees can use social media as a platform for disseminating hate information or harassing other employees, which may subject employers to liability. Bill 168, which amended the Occupational Health and Safety Act, includes a very broad definition of harassment: engaging in a course of vexatious comment or conduct against a worker in a workplace that is known or ought reasonably to be known to be unwelcome. Employers are obligated to prepare policies with respect to workplace violence and workplace harassment; develop and maintain programs to implement their policies; and provide information and instruction to workers on the contents of these policies and programs. Employers may also be found liable under the Ontario Human Rights Code for failure to prevent and/or stop online harassment in the workplace, or found vicariously liable for the actions of one of its employees against another if the actions took place within the course and scope of the employment relationship. 2 What Employers Can Do There are a number of steps employers can take to mitigate the negative consequences of employees use of social media: 1. Create an Internet use policy (more detail on this below); 2. Communicate the rules of Internet use to employees on a regular basis: Inform employees that they are responsible for what they post on the Internet; and 2 Paulin v. P.C.M. Collections Limited, 2007 CanLII (Ont. S.C.J.); Bazley v. Curry, [1999] 2 S.C.R. 534.

8 - 8 - Remind employees that what they post online is public; 3. Remind employees that they have a duty of loyalty to their employer; 4. Remind employees about copyright issues: Inform employees that they cannot use the company name or logo; and Inform employees that they cannot publicly disclose customer names, information about other employees etc.; and 5. Ban social networking sites: The Ontario Government and the City of Toronto have banned Facebook in the workplace; However there are some benefits of social networking sites for the workplace; namely, they can be used to make corporate announcements, in-house bulletin boards, and generate publicity for new products. What to Include In an Internet Use Policy It is imperative that all organizations have an Internet use policy. An Internet use policy should include the following items: 1. The computer and computer system (including all records and data on the system, e.g. ) are property of the employer; 2. The specific reasons for which the Internet may be used at work;

9 Which types of websites are prohibited or limited; For example, no pornographic or obscene material should be viewed, browsed, downloaded or forwarded while at work or at home from the company s computer or network; and No offensive or derogatory remarks should be made online about competitors, customers, other employees or anyone else; 4. The employer s computer systems cannot be used to duplicate or transmit copyrighted material, or any confidential or sensitive information unless it is in the course of the employees duties; Employees must safeguard passwords and/or access codes; 5. The company will monitor Internet usage; All data created or stored on the computer system, including , will be reviewed whether used at work or on the company s network at home; 6. Consequences for breach of the policy; For example, disciplinary action, up to and including termination, will be considered; and Types of breaches, if any, that may result in automatic termination.

10 When an employee is hired, he or she should sign the Internet use policy to say that he or she has read the policy, understands its terms, and agrees to be bound by it. Employees should sign the policy periodically, and when any changes are made to it. The policy should be enforced consistently. All employees, regardless of what position they hold in the company, should be subject to the same enforcement procedures. A clear policy will help employers prevent social media misuse and better address social media misuse if and when the need arises. Employers should consider adopting a similar policy for cell phone and Blackberry use. Monitoring and Surveillance Subject to privacy laws, employers may wish to monitor the online activities of future, present, and/or past employees. Screening Prospective Employees Approximately 45% of employers now screen candidates online, most commonly by looking at candidates Facebook, LinkedIn and MySpace profiles. As a result of this screening process, 35% of employers have decided not to offer a candidate a job. Seven percent of employers follow prospective employees on Twitter. Most often, employers are looking for provocative behaviour or alcohol and drug use. Employers also look for disparaging remarks made against past or current employers, as well as the candidate s communication skills.

11 Current Employees With respect to current employees, there are a variety of tools available for monitoring Internet usage, including computer application use, keystrokes, and periodic screen shots. Employers can also install basic filtering programs or hire outside organizations that monitor websites. It is a misconception that employees cannot be disciplined for online activities when they are offduty. Employees may be disciplined if their conduct negatively effects their employers reputation, damages morale, or amounts to harassment. Five criteria were set out in E.V. Logistics and R.W.D.S.U. 3 for when an employee may be disciplined for conduct that occurred outside of the workplace: 1. The conduct of the grievor harms the Company s reputation or product; 2. The grievor s behaviour renders the employee unable to perform his duties satisfactorily; 3. The grievor s behaviour leads to refusal, reluctance or inability of the other employees to work with him; 4. The grievor has been guilty of a serious breach of the Criminal Code and thus rendering his conduct injurious to the general reputation of the Company and its employees; or 5. Places difficulty in the way of the Company properly carrying out its function of efficiently managing its Works and efficiently direct its working force. The following cases illustrate situations in which employers have taken action in respect of their employees inappropriate internet or computer use. 3 [2008] B.C.C.A.A.A. No. 22

12 In D.D. v. H.A. 4, the employer noticed an unusual pattern of Internet use by an employee. The employee was accessing porn sites, Facebook, etc. for several hours a day at work. The employer gave the complainant the option of resigning or being dismissed. The employee s activities violated the employer s computer use policy and were also considered time theft. The employee brought a complaint under s. 13 of the B.C. Human Rights Code alleging that a regional provincial health authority, and members of its staff, discriminated against him by failing to properly take account of and accommodate his psychological or mental disability. The complainant argued that the respondents ought to have at the very least investigated the state of his mental health before pressuring him to resign. The arbitrator accepted the complainant s submission that the employer had known about the employee s psychological problems, including depression; however, the employee s complaint was rejected because the employer was found to have properly addressed the employees needs, and because it was unreasonable for the employer to have associated the inappropriate Internet activities and the complainant s health issues. In Northcott v. Abbott, 5 the plaintiff owned a company and employed the defendant to run a website. The defendant violated his confidentiality agreement by announcing on the message board of the website that the company was changing owners, and then he created his own website and lured customers and sponsors to that website. The Court held that the defendant was responsible for 80% of the plaintiff s business losses, and $100,000 in punitive damages was also awarded. 4 [2008] B.C.H.R.T.D. No [2004] B.C.J. No. 1965

13 In Chatham-Kent (Municipality) v. National Automobile, Aerospace, Transportation and General Workers Union of Canada (CAW-Canada), Local 127 (Clarke Grievance), 6 the grievor was a personal care giver at a nursing home. The employer terminated her for cause due to breach of the confidentiality agreement (signed by the grievor), insubordination, and conduct unbefitting a personal care giver. The grievor had a website where she published text and pictures about various residents without their consent. The arbitrator pointed out that the standards of confidentiality in the health care sector are especially high, and that the grievor had signed a confidentiality agreement. Moreover, the training manual expressly stated that information should be kept out of social conversation. The termination was upheld. In Alberta v. Alberta Union of Provincial Employees (R. Grievance), 7 the employer terminated an employee after investigating negative comments the employee made in an online forum about co-workers and management. Although she used aliases instead of actual names, it was easy to identify who the employee was referring to. She used her own name in the blog and in one entry identified her place of employment. The grievor s main defence was that she did not know that her blog was publicly accessible. She also argued that she did not realize that her blog postings were hurtful or insubordinate. The arbitrator found that the grievor took no steps to block public access to her blog, and also took into account the disparaging nature of the comments and the employee s belligerent reaction and lack of remorse when confronted by management. The termination was upheld. 8 6 [2007] O.L.A.A. No [2008] A.G.A.A. No. 20. (reversed on judicial review on other grounds; the employer failed to comply with the due process for discipline provided for in Collective Agreement). 8 Although it was later overturned on appeal because the employer had failed to follow the procedural requirements in the collective agreement.

14 In Alberta Distillers Ltd. v. United Food and Commercial Workers, Local 1118 (Whiteside Grievance), 9 an employee told management that the work environment in the Alberta Distillers packing department was toxic and that derogatory remarks about her had been posted by another employee on the grievor s Facebook page. The employer had a workplace harassment policy in place, but it did not cover employees use of social media outside the workplace. The employer terminated the grievor under the misapprehension that the grievor had posted the comments when in fact it was another employee. Since the grievor did not make the derogatory comments, or condone them in any way, the board held that there was no just cause for discipline and ordered that the grievor be reinstated. In E.V. Logistics and R.W.D.S.U., 10 the grievor was a warehouse employee who created a public blog and posted a number of racist and violent comments, in addition to descriptions of various examples of his workplace misconduct. When confronted by management, the grievor removed the blog and apologised. The employer decided to terminate his employment anyway. The arbitrator held that a lengthy suspension, but not termination, was warranted because the employee had difficult personal circumstances and a history of depression, the employee had made a full and complete apology, and the hateful remarks were not directed at the employer or coworkers. In Poliquin v. Devon Canada Corporation, 11 the grievor was terminated for, among other things, transmitting pornographic and racist material over the company s network using the company s computer in violation of the company s Code of Conduct. In summarily dismissing the grievor s wrongful dismissal action, the Court stated the following: 9 [2009] A.G.A.A. No [2008] B.C.C.A.A.A. No ABCA 216.

15 Employers have the right to set the ethical, professional and operational standards for their workplaces. Doing so not only falls within an employer s management rights, it also constitutes an integral component of corporate good governance. The workplace is not an employee s home; and employees have no reasonable expectation of privacy in their workplace computers. It therefore follows that while employers may permit employees limited personal use of workplace computers, the employer is entitled to restrict the terms and conditions on which that use may be permitted. The Court went on to say that an employer is entitled not only to prohibit use of its equipment and systems for pornographic or racist purposes but also to monitor an employee s use of the employer s equipment and resources to ensure compliance. In R v. Cole, 12 nude photos of a student were found in a teacher s folder on the school s computer network. The teacher s computer and data files were turned over to the police. The police were told by the employer that the laptop and data contained on it and the school s server were the property of the school board and did not belong to the teacher; as a result, the police did not obtain a search warrant prior to viewing the images or the computer. The teacher argued that this search violated his s. 8 rights under the Canadian Charter of Rights and Freedoms. The Court held that the search was reasonable because the teacher did not have an objectively reasonable expectation of privacy in the computer. The teacher was aware that the laptop was the property of the school, there was an acceptable Internet use agreement in place that stated that users should not assume that information stored on the network will be kept private, and there was a policy statement which stated that the network should not be used for posting or accessing inappropriate content, including pornographic material CanLII (ON S.C.).

16 Former Employees The online activities of past employees may also be helpful: (a) if the employer is being sued; (b) to ascertain whether the plaintiff is really sick/disabled; (c) to see if the plaintiff has mitigated his or her damages; (d) to see if the plaintiff was truthful during her employment; and/or (e) to ascertain if there is information to support an after-acquired cause. For example, in 2009, an employee working at IBM in Quebec lost her sick leave benefits as a result of photographs she posted on Facebook. The employee had been on leave from her job for a year and a half after she was diagnosed with major depression. The insurance company stopped giving her benefits when they found photographs on Facebook that showed her out with friends at a bar, a birthday party, and on vacation. CONCLUSION Although the privacy rights of employees are increasing, in some provinces more than others, employers should not shy away from taking action to monitor and deal with their employees inappropriate computer and internet use. Before doing so, employers should take note of any privacy restrictions. But employers should remember that they are still the employer and can control what use is made of such resources in their workplaces.